Ticket #7768: 7768.diff

wp-admin/includes/post.php

@@ -342 +342 @@
 
         $protected = array( '_wp_attached_file', '_wp_attachment_metadata', '_wp_old_slug', '_wp_page_template' );
 
-        $metakeyselect = $wpdb->escape( stripslashes( trim( $_POST['metakeyselect'] ) ) );
-        $metakeyinput = $wpdb->escape( stripslashes( trim( $_POST['metakeyinput'] ) ) );
-        $metavalue = maybe_serialize( stripslashes( (trim( $_POST['metavalue'] ) ) ));
-        $metavalue = $wpdb->escape( $metavalue );
+        $metakeyselect = stripslashes( trim( $_POST['metakeyselect'] ) );
+        $metakeyinput = stripslashes( trim( $_POST['metakeyinput'] ) );
+        $metavalue = maybe_serialize( stripslashes( trim( $_POST['metavalue'] ) ) );
 
         if ( ('0' === $metavalue || !empty ( $metavalue ) ) && ((('#NONE#' != $metakeyselect) && !empty ( $metakeyselect) ) || !empty ( $metakeyinput) ) ) {
                 // We have a key/value pair. If both the select and the
@@ -362 +361 @@
 
                 wp_cache_delete($post_ID, 'post_meta');
 
-                $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->postmeta
-                        (post_id,meta_key,meta_value ) VALUES (%s, %s, %s)",
-                        $post_ID, $metakey, $metavalue) );
+                $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->postmeta (post_id,meta_key,meta_value ) VALUES (%s, %s, %s)", $post_ID, $metakey, $metavalue) );
                 return $wpdb->insert_id;
         }
         return false;

wp-includes/post.php

@@ -519 +519 @@
 
         // expected_slashed ($meta_key)
         $meta_key = stripslashes($meta_key);
+        $meta_value = stripslashes($meta_value);
 
         if ( $unique && $wpdb->get_var( $wpdb->prepare( "SELECT meta_key FROM $wpdb->postmeta WHERE meta_key = %s AND post_id = %d", $meta_key, $post_id ) ) )
                 return false;
@@ -631 +632 @@
 
         // expected_slashed ($meta_key)
         $meta_key = stripslashes($meta_key);
+        $meta_value = stripslashes($meta_value);
 
         if ( ! $wpdb->get_var( $wpdb->prepare( "SELECT meta_key FROM $wpdb->postmeta WHERE meta_key = %s AND post_id = %d", $meta_key, $post_id ) ) ) {
                 return add_post_meta($post_id, $meta_key, $meta_value);